Use ansible instead of direct ssh calls

Instead of a shell script looping over ssh calls, use a simple
ansible playbook. The benefit this gets is that we can then also
script ad-hoc admin tasks either via playbooks or on the command
line. We can also then get rid of the almost entirely unused
salt infrastructure.

Change-Id: I53112bd1f61d94c0521a32016c8a47c8cf9e50f7

files/ansible.cfg

@@ -0,0 +1,3 @@
+[defaults]
+hostfile=/usr/local/bin/puppet-inventory
+log_path=/var/log/ansible.log

files/puppet-inventory

@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+# Copyright (c) 2014 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+import subprocess
+
+output = [
+    x.split()[1][1:-1] for x in subprocess.check_output(
+        ["puppet","cert","list","-a"]).split('\n')
+    if x.startswith('+')
+]
+
+data = {
+    '_meta': {'hostvars': dict()},
+    'ungrouped': output,
+}
+print json.dumps(data, sort_keys=True, indent=2)

files/roles/puppet/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: run puppet
+  command: timeout -s 9 30m puppet agent --onetime --ignorecache --no-daemonize --no-usecacheonfailure --no-splay --detailed-exitcodes --verbose
+  register: result
+  failed_when: "result.rc != 0 and result.rc != 2"
+  changed_when: "result.rc == 4 or result.rc == 6"

manifests/init.pp

@@ -0,0 +1,53 @@
+# == Class: ansible
+#
+class ansible {
+
+  include logrotate
+  include pip
+
+  package { 'ansible':
+    ensure   => latest,
+    provider => pip,
+  }
+
+  if ! defined(File['/etc/ansible']) {
+    file { '/etc/ansible':
+      ensure  => directory,
+    }
+  }
+
+  file { '/etc/ansible/ansible.cfg':
+    ensure  => present,
+    source  => 'puppet:///modules/ansible/ansible.cfg',
+    require => File['/etc/ansible'],
+  }
+
+  file { '/usr/local/bin/puppet-inventory':
+    ensure => present,
+    mode   => '0755',
+    owner  => 'root',
+    group  => 'root',
+    source => 'puppet:///modules/ansible/puppet-inventory',
+  }
+
+  file { '/etc/ansible/roles':
+    ensure  => directory,
+    recurse => true,
+    source  => 'puppet:///modules/ansible/roles',
+    require => File['/etc/ansible'],
+  }
+
+  include logrotate
+  logrotate::file { 'ansible':
+    log     => '/var/log/ansible.log',
+    options => [
+      'compress',
+      'copytruncate',
+      'missingok',
+      'rotate 7',
+      'daily',
+      'notifempty',
+    ],
+  }
+
+}